SB2006030501 - Information disclosure in Apache Tomcat JK ISAPI Connector
Published: March 5, 2006
Security Bulletin ID
SB2006030501
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2006-7197)
The vulnerability allows a remote unauthenticated user to obtain potentially sensitive information on the target system.The weakness is due to setting of too long chunks delivered by send_body_chunks AJP messages. Excessive length of the chunks causes mod_jk to read beyond buffer boundaries that leads to disclosure of sensitive information to the attacker.
Successful exploitation of the vulnerability results in malicious user's access to important data on the vulnerable system.
Remediation
Install update from vendor's website.